@frontmcp/plugin-skilled-openapi 1.8.2 → 1.8.4

package/esm/index.mjs

@@ -11,12 +11,14 @@ var __decorateClass = (decorators, target, key2, kind) => {
 
 // plugins/plugin-skilled-openapi/src/skilled-openapi.plugin.ts
 import {
-  BundleStore,
+  BundleStore as BundleStore3,
   createBundleSource
 } from "@frontmcp/adapters/skills";
 import {
   buildSkillsCatalogSummary,
   DynamicPlugin,
+  FlowHooksOf,
+  FrontMcpContextStorage,
   FrontMcpLogger,
   ListToolsHook,
   Plugin,
@@ -122,16 +124,61 @@ import {
   AuthoritiesEvaluatorRegistry,
   AuthoritiesProfileRegistry
 } from "@frontmcp/auth";
+function policyDependsOnInput(value) {
+  if (typeof value === "string") return value === "input" || value.startsWith("input.");
+  if (Array.isArray(value)) return value.some(policyDependsOnInput);
+  if (value !== null && typeof value === "object") {
+    for (const [key2, nested] of Object.entries(value)) {
+      if (key2 === "fromInput" || key2 === "custom" || key2 === "guards") return true;
+      if (policyDependsOnInput(key2) || policyDependsOnInput(nested)) return true;
+    }
+  }
+  return false;
+}
+function judgeablePart(policy, engine) {
+  if (policy === void 0 || policy === null) return void 0;
+  const profileDependsOnInput = (name) => typeof name === "string" && policyDependsOnInput(engine.resolveProfile(name));
+  const value = policy;
+  if (typeof value === "string") return profileDependsOnInput(value) ? void 0 : policy;
+  if (Array.isArray(value)) {
+    const names = value.filter((name) => !profileDependsOnInput(name));
+    return names.length > 0 ? names : void 0;
+  }
+  return policyDependsOnInput(policy) ? void 0 : policy;
+}
 var AuthorityGuard = class {
   engine;
   contextBuilder;
   logger;
+  serverAuthorities;
   constructor(opts = {}) {
     const profiles = opts.profiles ?? new AuthoritiesProfileRegistry();
     const evaluators = opts.evaluators ?? new AuthoritiesEvaluatorRegistry();
     this.engine = new AuthoritiesEngine(profiles, evaluators);
     this.contextBuilder = new AuthoritiesContextBuilder();
     this.logger = opts.logger;
+    this.serverAuthorities = opts.serverAuthorities;
+  }
+  /** The server's engine and context builder when it configures authorities, else the guard's own. */
+  authorities() {
+    return this.serverAuthorities?.() ?? { engine: this.engine, contextBuilder: this.contextBuilder };
+  }
+  /**
+   * Whether the caller may be shown a skill or action (in `search_skill`,
+   * `load_skill`, the catalog and the SDK skill surfaces), judged without the
+   * action's input. A rule that depends on the input can't be judged yet and
+   * doesn't hide anything; the call is still checked by {@link check}. Every other
+   * rule must grant, and a policy-less action under `unprotectedOps: 'deny'` must
+   * be public, exactly as at call time.
+   */
+  async canDiscover(args) {
+    const { engine } = this.authorities();
+    const hasPolicy = [args.skillPolicy, args.policy].some((p) => p !== void 0 && p !== null);
+    const skillPolicy = judgeablePart(args.skillPolicy, engine);
+    const policy = judgeablePart(args.policy, engine);
+    if (hasPolicy && skillPolicy === void 0 && policy === void 0) return true;
+    const result = await this.check({ ...args, skillPolicy, policy, input: {} });
+    return result.granted;
   }
   async check(args) {
     const { policy, skillPolicy, isPublic, authInfo, input, env } = args;
@@ -149,10 +196,11 @@ var AuthorityGuard = class {
       return { granted: true, evaluatedPolicies: [] };
     }
     try {
-      const ctx = this.contextBuilder.build(authInfo, input, env);
+      const { engine, contextBuilder } = this.authorities();
+      const ctx = contextBuilder.build(authInfo, input, env);
       const evaluatedPolicies = [];
       for (const p of policies) {
-        const res = await this.engine.evaluate(p, ctx);
+        const res = await engine.evaluate(p, ctx);
         evaluatedPolicies.push(...res.evaluatedPolicies ?? []);
         if (!res.granted) {
           return { ...res, evaluatedPolicies };
@@ -180,6 +228,112 @@ function normalizeCaughtMessage(e) {
   return String(e ?? "authority evaluation threw");
 }
 
+// plugins/plugin-skilled-openapi/src/security/skill-visibility.ts
+import { filterServableSkills } from "@frontmcp/sdk";
+function bundleSkillPolicies(bundle) {
+  const policies = /* @__PURE__ */ new Map();
+  for (const skill of bundle?.skills ?? []) {
+    if (skill.requiredAuthorities !== void 0 && skill.requiredAuthorities !== null) {
+      policies.set(skill.id, skill.requiredAuthorities);
+    }
+  }
+  return policies;
+}
+var SkillVisibility = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.policies = bundleSkillPolicies(deps.bundle);
+    this.authInfo = deps.authInfo ?? {};
+  }
+  deps;
+  policies;
+  authInfo;
+  /** Whether the caller satisfies the bundle skill's own `requiredAuthorities` (true for other skills). */
+  async passesBundleSkillRule(skillId) {
+    const skillPolicy = this.policies.get(skillId);
+    if (skillPolicy === void 0) return true;
+    return this.deps.guard.canDiscover({ skillPolicy, authInfo: this.authInfo });
+  }
+  /**
+   * Keep the items whose skill the caller may see: the bundle skill's rule, the
+   * `skills:filter` flow and the server's `@Skill({ authorities })` rule. An item
+   * whose id names no registered skill (an external skill) is judged by the bundle
+   * rule alone, as the SDK's own surfaces keep such results.
+   */
+  async filterVisible(items, idOf) {
+    if (items.length === 0) return [];
+    const entries = items.map((item) => this.resolveEntry(idOf(item)));
+    const registered = [...new Set(entries.filter((entry) => entry !== void 0))];
+    const visibleEntries = new Set(await this.filterVisibleEntries(registered));
+    const visible = [];
+    for (const [index, item] of items.entries()) {
+      const entry = entries[index];
+      if (entry ? !visibleEntries.has(entry) : !await this.passesBundleSkillRule(idOf(item))) continue;
+      visible.push(item);
+    }
+    return visible;
+  }
+  /** The registered skills the caller may see, in their order (see {@link filterVisible}). */
+  async filterVisibleEntries(entries) {
+    if (entries.length === 0) return [];
+    const servable = new Set(await filterServableSkills(this.deps.scope, entries));
+    const visible = [];
+    for (const entry of entries) {
+      if (!servable.has(entry) || !await this.passesSkillAuthorities(entry)) continue;
+      if (!await this.passesBundleSkillRule(entry.metadata.id ?? entry.name)) continue;
+      visible.push(entry);
+    }
+    return visible;
+  }
+  /** Whether the caller may see the skill named by `skillId` (see {@link filterVisible}). */
+  async isVisible(skillId) {
+    return (await this.filterVisible([skillId], (id) => id)).length === 1;
+  }
+  /**
+   * The actions of a bundle skill the caller may be shown: an action whose rules
+   * refuse the caller whatever the input (or that `unprotectedOps: 'deny'` blocks)
+   * is left out. Rules that depend on the input keep the action listed; the call is
+   * checked again when it runs.
+   */
+  async visibleActions(skillId, actions, hiddenOps) {
+    const visible = [];
+    for (const action of actions) {
+      const entry = hiddenOps.get(skillId, action.actionId);
+      if (!entry) continue;
+      const allowed = await this.deps.guard.canDiscover({
+        policy: entry.op.requiredAuthorities,
+        skillPolicy: entry.skillRequiredAuthorities,
+        isPublic: entry.op.public,
+        unprotectedOps: this.deps.unprotectedOps,
+        authInfo: this.authInfo
+      });
+      if (allowed) visible.push(action);
+    }
+    return visible;
+  }
+  /** The server's `@Skill({ authorities })` rule, evaluated as the SDK's skill surfaces do. */
+  async passesSkillAuthorities(entry) {
+    const { authoritiesEngine: engine, authoritiesContextBuilder: contextBuilder } = this.deps.scope;
+    const authorities = entry.metadata["authorities"];
+    if (!engine || !contextBuilder || !authorities) return true;
+    try {
+      const result = await engine.evaluate(
+        authorities,
+        contextBuilder.build(this.authInfo)
+      );
+      return result.granted;
+    } catch {
+      return false;
+    }
+  }
+  /** The registered skill an id names, looked up the way the SDK's skill surfaces do. */
+  resolveEntry(id) {
+    const registry = this.deps.scope.skills;
+    if (!registry) return void 0;
+    return registry.findByName(id) ?? (id.includes(":") ? registry.findByQualifiedName(id) : void 0) ?? registry.getSkills(true).find((skill) => (skill.metadata.id ?? skill.name) === id || skill.metadata.name === id);
+  }
+};
+
 // plugins/plugin-skilled-openapi/src/skilled-openapi.symbols.ts
 var SkilledOpenApiConfig = class {
   constructor(options) {
@@ -642,6 +796,7 @@ function collectPathsWithGet(entries) {
 }
 
 // plugins/plugin-skilled-openapi/src/tools/load-skill.tool.ts
+import { BundleStore } from "@frontmcp/adapters/skills";
 import { InternalMcpError, PublicMcpError, ScopeEntry, Tool, ToolContext } from "@frontmcp/sdk";
 
 // plugins/plugin-skilled-openapi/src/tools/load-skill.schema.ts
@@ -690,11 +845,25 @@ var LoadSkillTool = class extends ToolContext {
     if (!skillRegistry) {
       throw new InternalMcpError("SkillRegistry is not available on the active scope", "SKILL_REGISTRY_UNAVAILABLE");
     }
+    const notFound = () => (
+      // Caller-visible: skill id was not registered, or the caller may not see it
+      // (the same answer, so a refused skill's existence isn't revealed). Map to a
+      // 404 with a stable code so MCP clients can branch on it.
+      new PublicMcpError(`Skill "${input.skillId}" not found`, "SKILL_NOT_FOUND", 404)
+    );
     const result = await skillRegistry.loadSkill(input.skillId);
-    if (!result) {
-      throw new PublicMcpError(`Skill "${input.skillId}" not found`, "SKILL_NOT_FOUND", 404);
-    }
+    if (!result) throw notFound();
+    const config = this.get(SkilledOpenApiConfig);
+    const visibility = new SkillVisibility({
+      scope,
+      guard: this.get(AuthorityGuard),
+      bundle: this.get(BundleStore).current(),
+      unprotectedOps: config.unprotectedOps,
+      authInfo: this.authInfo
+    });
     const skill = result.skill;
+    if (!await visibility.isVisible(input.skillId) || !await visibility.isVisible(skill.id)) throw notFound();
+    const actions = skill.actions ? await visibility.visibleActions(skill.id, skill.actions, this.get(HiddenOpRegistry)) : void 0;
     return {
       skill: {
         id: skill.id,
@@ -702,7 +871,7 @@ var LoadSkillTool = class extends ToolContext {
         description: skill.description,
         instructions: skill.instructions,
         ...skill.bundleVersion !== void 0 && { bundleVersion: skill.bundleVersion },
-        ...skill.actions ? { actions: skill.actions } : {}
+        ...actions ? { actions } : {}
       },
       isComplete: result.isComplete,
       ...result.warning !== void 0 && { warning: result.warning }
@@ -1539,6 +1708,7 @@ var searchSkillOutputSchema = {
 };
 
 // plugins/plugin-skilled-openapi/src/tools/search-skill.tool.ts
+import { BundleStore as BundleStore2 } from "@frontmcp/adapters/skills";
 import { ScopeEntry as ScopeEntry2, Tool as Tool3, ToolContext as ToolContext3 } from "@frontmcp/sdk";
 var SearchSkillTool = class extends ToolContext3 {
   async execute(input) {
@@ -1550,14 +1720,23 @@ var SearchSkillTool = class extends ToolContext3 {
     }
     const limit = input.limit ?? 20;
     const tags = input.tags;
-    const results = await skillRegistry.search(input.query, {
-      topK: limit,
+    const found = await skillRegistry.search(input.query, {
+      // Over-fetch: skills the caller may not see are removed below.
+      topK: limit * 4,
       ...tags ? { tags } : {},
       // Anti-query demotion (honored when the skill index supports it) — surfaces
       // what the user wants while pushing down what they explicitly do not.
       ...input.notQuery !== void 0 ? { negativeQuery: input.notQuery } : {},
       ...input.notWeight !== void 0 ? { negativeWeight: input.notWeight } : {}
     });
+    const visibility = new SkillVisibility({
+      scope,
+      guard: this.get(AuthorityGuard),
+      bundle: this.get(BundleStore2).current(),
+      unprotectedOps: this.get(SkilledOpenApiConfig).unprotectedOps,
+      authInfo: this.authInfo
+    });
+    const results = (await visibility.filterVisible(found, (r) => r.metadata.id ?? r.metadata.name)).slice(0, limit);
     return {
       skills: results.map((r) => ({
         skillId: r.metadata.id ?? r.metadata.name,
@@ -1584,6 +1763,7 @@ SearchSkillTool = __decorateClass([
 
 // plugins/plugin-skilled-openapi/src/skilled-openapi.plugin.ts
 var TELEMETRY_FACTORY_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:observability:telemetry-factory");
+var FilterSkillsHook = FlowHooksOf("skills:filter");
 var SKILLED_OPENAPI_RUNTIME_DEPS_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:skilled-openapi:runtime-deps");
 function resolveRuntimeDeps(scope) {
   const providers = scope?.providers;
@@ -1634,15 +1814,61 @@ var SkilledOpenApiPlugin = class extends DynamicPlugin {
     } catch {
     }
     const scope = this.get(ScopeEntry3);
+    const visible = await this.skillVisibility(scope, flowCtx.state.authInfo).filterVisibleEntries(
+      scope.skills?.getSkills({ visibility: "mcp" }) ?? []
+    );
     const catalog = buildSkillsCatalogSummary(scope.skills, {
-      mcpResources: scope.metadata?.skillsConfig?.mcpResources
+      mcpResources: scope.metadata?.skillsConfig?.mcpResources,
+      skills: visible
     });
     const description = catalog ? `${searchSkillDescription}
 
 ---
 
 ${catalog}` : searchSkillDescription;
-    target.tool.metadata.description = description;
+    const perRequestTool = Object.create(target.tool, {
+      metadata: { value: { ...target.tool.metadata, description }, enumerable: true }
+    });
+    flowCtx.state.set(
+      "tools",
+      tools.map((item) => item === target ? { ...item, tool: perRequestTool } : item)
+    );
+  }
+  async hideBundleSkillsFromCaller(flowCtx) {
+    const { skills } = flowCtx.state;
+    if (!skills || skills.length === 0) return;
+    const bundle = this.get(BundleStore3).current();
+    const policies = bundleSkillPolicies(bundle);
+    if (policies.size === 0) return;
+    const visibility = new SkillVisibility({
+      scope: this.get(ScopeEntry3),
+      guard: this.get(AuthorityGuard),
+      bundle,
+      unprotectedOps: this.options.unprotectedOps,
+      authInfo: this.currentAuthInfo()
+    });
+    const kept = [];
+    for (const skill of skills) {
+      if (await visibility.passesBundleSkillRule(skill.metadata.id ?? skill.name)) kept.push(skill);
+    }
+    if (kept.length !== skills.length) flowCtx.state.set("skills", kept);
+  }
+  skillVisibility(scope, authInfo) {
+    return new SkillVisibility({
+      scope,
+      guard: this.get(AuthorityGuard),
+      bundle: this.get(BundleStore3).current(),
+      unprotectedOps: this.options.unprotectedOps,
+      authInfo
+    });
+  }
+  /** The AuthInfo of the request being served; an anonymous caller when there is none. */
+  currentAuthInfo() {
+    try {
+      return this.get(FrontMcpContextStorage)?.getStore()?.authInfo ?? {};
+    } catch {
+      return {};
+    }
   }
   warnIfInsecureConfig() {
     if (this.options.dev) {
@@ -1664,7 +1890,7 @@ ${catalog}` : searchSkillDescription;
       { name: "skilled-openapi:hidden-ops", provide: HiddenOpRegistry, useValue: new HiddenOpRegistry() },
       {
         name: "skilled-openapi:bundle-store",
-        provide: BundleStore,
+        provide: BundleStore3,
         // Resolve TelemetryAccessor from the scope's provider registry so the
         // bundle-pulls counter and `skill.bundle.swap` span actually export.
         // The accessor is structurally compatible with `BundleStoreTelemetry`.
@@ -1672,7 +1898,7 @@ ${catalog}` : searchSkillDescription;
         // we resolve `undefined` and the BundleStore falls through its zero-cost
         // no-telemetry path.
         inject: () => [ScopeEntry3],
-        useFactory: (scope) => new BundleStore({ telemetry: resolveBundleTelemetry(scope) })
+        useFactory: (scope) => new BundleStore3({ telemetry: resolveBundleTelemetry(scope) })
       },
       {
         name: "skilled-openapi:credential-resolver",
@@ -1683,12 +1909,22 @@ ${catalog}` : searchSkillDescription;
         name: "skilled-openapi:authority-guard",
         provide: AuthorityGuard,
         inject: () => [ScopeEntry3],
-        useFactory: (scope) => new AuthorityGuard({ logger: scope.logger.child("skilled-openapi:authority") })
+        useFactory: (scope) => new AuthorityGuard({
+          logger: scope.logger.child("skilled-openapi:authority"),
+          // Bundle rules follow the server's authorities settings (claimsMapping,
+          // claimsResolver, relationshipResolver, evaluators) when it has them. Read per check:
+          // the server may register its engine after this provider is built.
+          serverAuthorities: () => {
+            const engine = scope.authoritiesEngine;
+            const contextBuilder = scope.authoritiesContextBuilder;
+            return engine && contextBuilder ? { engine, contextBuilder } : void 0;
+          }
+        })
       },
       {
         name: "skilled-openapi:bundle-sync",
         provide: BundleSyncService,
-        inject: () => [ScopeEntry3, HiddenOpRegistry, BundleStore],
+        inject: () => [ScopeEntry3, HiddenOpRegistry, BundleStore3],
         useFactory: async (scope, hiddenOps, bundleStore) => {
           const logger = scope.logger.child("skilled-openapi:sync");
           const lazySkillRegistry = new Proxy({}, {
@@ -1773,12 +2009,18 @@ ${catalog}` : searchSkillDescription;
 __decorateClass([
   ListToolsHook.Did("findTools", { priority: 50 })
 ], SkilledOpenApiPlugin.prototype, "injectSkillCatalogIntoSearchTool", 1);
+__decorateClass([
+  FilterSkillsHook.Did("filterSkills", { priority: 50 })
+], SkilledOpenApiPlugin.prototype, "hideBundleSkillsFromCaller", 1);
 SkilledOpenApiPlugin = __decorateClass([
   Plugin({
     name: "skilled-openapi",
     description: "Serve a customer's OpenAPI spec as signed skill bundles with hidden per-operation tools mediated by 3 meta-tools.",
     providers: [],
-    tools: [SearchSkillTool, LoadSkillTool, RunWorkflowTool]
+    tools: [SearchSkillTool, LoadSkillTool, RunWorkflowTool],
+    // The bundle's skills are registered after startup: serve the skills capability and methods from
+    // startup, answering with the skills loaded so far.
+    dynamicSkills: true
   })
 ], SkilledOpenApiPlugin);
 

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-skilled-openapi",
-  "version": "1.8.2",
+  "version": "1.8.4",
   "description": "FrontMCP plugin: serve a customer's OpenAPI spec as skill bundles (signed, OpenAPI-Overlay-based) with hidden per-operation tools mediated by three meta-tools (search_skill / load_skill / run_workflow — the last runs an enclave-sandboxed AgentScript that orchestrates the loaded skills' operations).",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -48,15 +48,15 @@
     }
   },
   "dependencies": {
-    "@frontmcp/adapters": "1.8.2",
-    "@frontmcp/auth": "1.8.2",
-    "@frontmcp/sdk": "1.8.2",
-    "@frontmcp/utils": "1.8.2"
+    "@frontmcp/adapters": "1.8.4",
+    "@frontmcp/auth": "1.8.4",
+    "@frontmcp/sdk": "1.8.4",
+    "@frontmcp/utils": "1.8.4"
   },
   "peerDependencies": {
     "@enclave-vm/ast": "*",
     "@enclave-vm/core": "*",
-    "@frontmcp/lazy-zod": "1.8.2"
+    "@frontmcp/lazy-zod": "1.8.4"
   },
   "peerDependenciesMeta": {
     "@enclave-vm/ast": {

package/index.js

@@ -48,8 +48,8 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // plugins/plugin-skilled-openapi/src/skilled-openapi.plugin.ts
-var import_skills6 = require("@frontmcp/adapters/skills");
-var import_sdk5 = require("@frontmcp/sdk");
+var import_skills8 = require("@frontmcp/adapters/skills");
+var import_sdk6 = require("@frontmcp/sdk");
 
 // plugins/plugin-skilled-openapi/src/executor/credential-resolver.ts
 var MemoryCredentialResolver = class {
@@ -145,16 +145,61 @@ var HiddenOpRegistry = class {
 
 // plugins/plugin-skilled-openapi/src/security/authority-guard.ts
 var import_auth = require("@frontmcp/auth");
+function policyDependsOnInput(value) {
+  if (typeof value === "string") return value === "input" || value.startsWith("input.");
+  if (Array.isArray(value)) return value.some(policyDependsOnInput);
+  if (value !== null && typeof value === "object") {
+    for (const [key2, nested] of Object.entries(value)) {
+      if (key2 === "fromInput" || key2 === "custom" || key2 === "guards") return true;
+      if (policyDependsOnInput(key2) || policyDependsOnInput(nested)) return true;
+    }
+  }
+  return false;
+}
+function judgeablePart(policy, engine) {
+  if (policy === void 0 || policy === null) return void 0;
+  const profileDependsOnInput = (name) => typeof name === "string" && policyDependsOnInput(engine.resolveProfile(name));
+  const value = policy;
+  if (typeof value === "string") return profileDependsOnInput(value) ? void 0 : policy;
+  if (Array.isArray(value)) {
+    const names = value.filter((name) => !profileDependsOnInput(name));
+    return names.length > 0 ? names : void 0;
+  }
+  return policyDependsOnInput(policy) ? void 0 : policy;
+}
 var AuthorityGuard = class {
   engine;
   contextBuilder;
   logger;
+  serverAuthorities;
   constructor(opts = {}) {
     const profiles = opts.profiles ?? new import_auth.AuthoritiesProfileRegistry();
     const evaluators = opts.evaluators ?? new import_auth.AuthoritiesEvaluatorRegistry();
     this.engine = new import_auth.AuthoritiesEngine(profiles, evaluators);
     this.contextBuilder = new import_auth.AuthoritiesContextBuilder();
     this.logger = opts.logger;
+    this.serverAuthorities = opts.serverAuthorities;
+  }
+  /** The server's engine and context builder when it configures authorities, else the guard's own. */
+  authorities() {
+    return this.serverAuthorities?.() ?? { engine: this.engine, contextBuilder: this.contextBuilder };
+  }
+  /**
+   * Whether the caller may be shown a skill or action (in `search_skill`,
+   * `load_skill`, the catalog and the SDK skill surfaces), judged without the
+   * action's input. A rule that depends on the input can't be judged yet and
+   * doesn't hide anything; the call is still checked by {@link check}. Every other
+   * rule must grant, and a policy-less action under `unprotectedOps: 'deny'` must
+   * be public, exactly as at call time.
+   */
+  async canDiscover(args) {
+    const { engine } = this.authorities();
+    const hasPolicy = [args.skillPolicy, args.policy].some((p) => p !== void 0 && p !== null);
+    const skillPolicy = judgeablePart(args.skillPolicy, engine);
+    const policy = judgeablePart(args.policy, engine);
+    if (hasPolicy && skillPolicy === void 0 && policy === void 0) return true;
+    const result = await this.check({ ...args, skillPolicy, policy, input: {} });
+    return result.granted;
   }
   async check(args) {
     const { policy, skillPolicy, isPublic, authInfo, input, env } = args;
@@ -172,10 +217,11 @@ var AuthorityGuard = class {
       return { granted: true, evaluatedPolicies: [] };
     }
     try {
-      const ctx = this.contextBuilder.build(authInfo, input, env);
+      const { engine, contextBuilder } = this.authorities();
+      const ctx = contextBuilder.build(authInfo, input, env);
       const evaluatedPolicies = [];
       for (const p of policies) {
-        const res = await this.engine.evaluate(p, ctx);
+        const res = await engine.evaluate(p, ctx);
         evaluatedPolicies.push(...res.evaluatedPolicies ?? []);
         if (!res.granted) {
           return { ...res, evaluatedPolicies };
@@ -203,6 +249,112 @@ function normalizeCaughtMessage(e) {
   return String(e ?? "authority evaluation threw");
 }
 
+// plugins/plugin-skilled-openapi/src/security/skill-visibility.ts
+var import_sdk = require("@frontmcp/sdk");
+function bundleSkillPolicies(bundle) {
+  const policies = /* @__PURE__ */ new Map();
+  for (const skill of bundle?.skills ?? []) {
+    if (skill.requiredAuthorities !== void 0 && skill.requiredAuthorities !== null) {
+      policies.set(skill.id, skill.requiredAuthorities);
+    }
+  }
+  return policies;
+}
+var SkillVisibility = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.policies = bundleSkillPolicies(deps.bundle);
+    this.authInfo = deps.authInfo ?? {};
+  }
+  deps;
+  policies;
+  authInfo;
+  /** Whether the caller satisfies the bundle skill's own `requiredAuthorities` (true for other skills). */
+  async passesBundleSkillRule(skillId) {
+    const skillPolicy = this.policies.get(skillId);
+    if (skillPolicy === void 0) return true;
+    return this.deps.guard.canDiscover({ skillPolicy, authInfo: this.authInfo });
+  }
+  /**
+   * Keep the items whose skill the caller may see: the bundle skill's rule, the
+   * `skills:filter` flow and the server's `@Skill({ authorities })` rule. An item
+   * whose id names no registered skill (an external skill) is judged by the bundle
+   * rule alone, as the SDK's own surfaces keep such results.
+   */
+  async filterVisible(items, idOf) {
+    if (items.length === 0) return [];
+    const entries = items.map((item) => this.resolveEntry(idOf(item)));
+    const registered = [...new Set(entries.filter((entry) => entry !== void 0))];
+    const visibleEntries = new Set(await this.filterVisibleEntries(registered));
+    const visible = [];
+    for (const [index, item] of items.entries()) {
+      const entry = entries[index];
+      if (entry ? !visibleEntries.has(entry) : !await this.passesBundleSkillRule(idOf(item))) continue;
+      visible.push(item);
+    }
+    return visible;
+  }
+  /** The registered skills the caller may see, in their order (see {@link filterVisible}). */
+  async filterVisibleEntries(entries) {
+    if (entries.length === 0) return [];
+    const servable = new Set(await (0, import_sdk.filterServableSkills)(this.deps.scope, entries));
+    const visible = [];
+    for (const entry of entries) {
+      if (!servable.has(entry) || !await this.passesSkillAuthorities(entry)) continue;
+      if (!await this.passesBundleSkillRule(entry.metadata.id ?? entry.name)) continue;
+      visible.push(entry);
+    }
+    return visible;
+  }
+  /** Whether the caller may see the skill named by `skillId` (see {@link filterVisible}). */
+  async isVisible(skillId) {
+    return (await this.filterVisible([skillId], (id) => id)).length === 1;
+  }
+  /**
+   * The actions of a bundle skill the caller may be shown: an action whose rules
+   * refuse the caller whatever the input (or that `unprotectedOps: 'deny'` blocks)
+   * is left out. Rules that depend on the input keep the action listed; the call is
+   * checked again when it runs.
+   */
+  async visibleActions(skillId, actions, hiddenOps) {
+    const visible = [];
+    for (const action of actions) {
+      const entry = hiddenOps.get(skillId, action.actionId);
+      if (!entry) continue;
+      const allowed = await this.deps.guard.canDiscover({
+        policy: entry.op.requiredAuthorities,
+        skillPolicy: entry.skillRequiredAuthorities,
+        isPublic: entry.op.public,
+        unprotectedOps: this.deps.unprotectedOps,
+        authInfo: this.authInfo
+      });
+      if (allowed) visible.push(action);
+    }
+    return visible;
+  }
+  /** The server's `@Skill({ authorities })` rule, evaluated as the SDK's skill surfaces do. */
+  async passesSkillAuthorities(entry) {
+    const { authoritiesEngine: engine, authoritiesContextBuilder: contextBuilder } = this.deps.scope;
+    const authorities = entry.metadata["authorities"];
+    if (!engine || !contextBuilder || !authorities) return true;
+    try {
+      const result = await engine.evaluate(
+        authorities,
+        contextBuilder.build(this.authInfo)
+      );
+      return result.granted;
+    } catch {
+      return false;
+    }
+  }
+  /** The registered skill an id names, looked up the way the SDK's skill surfaces do. */
+  resolveEntry(id) {
+    const registry = this.deps.scope.skills;
+    if (!registry) return void 0;
+    return registry.findByName(id) ?? (id.includes(":") ? registry.findByQualifiedName(id) : void 0) ?? registry.getSkills(true).find((skill) => (skill.metadata.id ?? skill.name) === id || skill.metadata.name === id);
+  }
+};
+
 // plugins/plugin-skilled-openapi/src/skilled-openapi.symbols.ts
 var SkilledOpenApiConfig = class {
   constructor(options) {
@@ -651,7 +803,8 @@ function collectPathsWithGet(entries) {
 }
 
 // plugins/plugin-skilled-openapi/src/tools/load-skill.tool.ts
-var import_sdk = require("@frontmcp/sdk");
+var import_skills4 = require("@frontmcp/adapters/skills");
+var import_sdk2 = require("@frontmcp/sdk");
 
 // plugins/plugin-skilled-openapi/src/tools/load-skill.schema.ts
 var import_lazy_zod2 = require("@frontmcp/lazy-zod");
@@ -691,19 +844,33 @@ var loadSkillOutputSchema = {
 };
 
 // plugins/plugin-skilled-openapi/src/tools/load-skill.tool.ts
-var LoadSkillTool = class extends import_sdk.ToolContext {
+var LoadSkillTool = class extends import_sdk2.ToolContext {
   async execute(input) {
     await this.get(BundleSyncService).ensureReady();
-    const scope = this.get(import_sdk.ScopeEntry);
+    const scope = this.get(import_sdk2.ScopeEntry);
     const skillRegistry = scope.skills;
     if (!skillRegistry) {
-      throw new import_sdk.InternalMcpError("SkillRegistry is not available on the active scope", "SKILL_REGISTRY_UNAVAILABLE");
+      throw new import_sdk2.InternalMcpError("SkillRegistry is not available on the active scope", "SKILL_REGISTRY_UNAVAILABLE");
     }
+    const notFound = () => (
+      // Caller-visible: skill id was not registered, or the caller may not see it
+      // (the same answer, so a refused skill's existence isn't revealed). Map to a
+      // 404 with a stable code so MCP clients can branch on it.
+      new import_sdk2.PublicMcpError(`Skill "${input.skillId}" not found`, "SKILL_NOT_FOUND", 404)
+    );
     const result = await skillRegistry.loadSkill(input.skillId);
-    if (!result) {
-      throw new import_sdk.PublicMcpError(`Skill "${input.skillId}" not found`, "SKILL_NOT_FOUND", 404);
-    }
+    if (!result) throw notFound();
+    const config = this.get(SkilledOpenApiConfig);
+    const visibility = new SkillVisibility({
+      scope,
+      guard: this.get(AuthorityGuard),
+      bundle: this.get(import_skills4.BundleStore).current(),
+      unprotectedOps: config.unprotectedOps,
+      authInfo: this.authInfo
+    });
     const skill = result.skill;
+    if (!await visibility.isVisible(input.skillId) || !await visibility.isVisible(skill.id)) throw notFound();
+    const actions = skill.actions ? await visibility.visibleActions(skill.id, skill.actions, this.get(HiddenOpRegistry)) : void 0;
     return {
       skill: {
         id: skill.id,
@@ -711,7 +878,7 @@ var LoadSkillTool = class extends import_sdk.ToolContext {
         description: skill.description,
         instructions: skill.instructions,
         ...skill.bundleVersion !== void 0 && { bundleVersion: skill.bundleVersion },
-        ...skill.actions ? { actions: skill.actions } : {}
+        ...actions ? { actions } : {}
       },
       isComplete: result.isComplete,
       ...result.warning !== void 0 && { warning: result.warning }
@@ -719,7 +886,7 @@ var LoadSkillTool = class extends import_sdk.ToolContext {
   }
 };
 LoadSkillTool = __decorateClass([
-  (0, import_sdk.Tool)({
+  (0, import_sdk2.Tool)({
     name: "load_skill",
     description: loadSkillDescription,
     inputSchema: loadSkillInputSchema,
@@ -732,8 +899,8 @@ LoadSkillTool = __decorateClass([
 ], LoadSkillTool);
 
 // plugins/plugin-skilled-openapi/src/tools/operation-tool.factory.ts
-var import_skills4 = require("@frontmcp/adapters/skills");
-var import_sdk2 = require("@frontmcp/sdk");
+var import_skills5 = require("@frontmcp/adapters/skills");
+var import_sdk3 = require("@frontmcp/sdk");
 
 // plugins/plugin-skilled-openapi/src/executor/openapi-runtime.ts
 var import_openapi = require("@frontmcp/adapters/openapi");
@@ -1147,16 +1314,16 @@ var OperationToolFactory = class {
     const executor = this.makeExecutor(entry);
     const metadata = buildOperationMetadata(entry);
     const record = {
-      kind: import_sdk2.ToolKind.FUNCTION,
+      kind: import_sdk3.ToolKind.FUNCTION,
       provide: executor,
       metadata
     };
-    const instance = new import_sdk2.ToolInstance(record, this.deps.providers, OPERATION_TOOL_OWNER);
+    const instance = new import_sdk3.ToolInstance(record, this.deps.providers, OPERATION_TOOL_OWNER);
     this.deps.toolRegistry.registerToolInstance(instance);
     this.registered.set(key2, executor);
     if (this.deps.classificationRegistry && ctx?.pathsWithGet) {
       try {
-        const classification = (0, import_skills4.classifyOne)(
+        const classification = (0, import_skills5.classifyOne)(
           entry.bundleId,
           {
             operationId: entry.op.operationId,
@@ -1270,8 +1437,8 @@ var OperationToolFactory = class {
 };
 
 // plugins/plugin-skilled-openapi/src/tools/run-workflow.tool.ts
-var import_skills5 = require("@frontmcp/adapters/skills");
-var import_sdk3 = require("@frontmcp/sdk");
+var import_skills6 = require("@frontmcp/adapters/skills");
+var import_sdk4 = require("@frontmcp/sdk");
 
 // plugins/plugin-skilled-openapi/src/executor/execute-skill-action.ts
 function formatZodIssues(issues) {
@@ -1419,7 +1586,7 @@ var runWorkflowOutputSchema = {
 var MAX_STEPS = 2e6;
 var MAX_TOOL_CALLS = 25;
 var TIMEOUT_MS = 8e3;
-var RunWorkflowTool = class extends import_sdk3.ToolContext {
+var RunWorkflowTool = class extends import_sdk4.ToolContext {
   async execute(input) {
     await this.get(BundleSyncService).ensureReady();
     const config = this.get(SkilledOpenApiConfig);
@@ -1437,7 +1604,7 @@ var RunWorkflowTool = class extends import_sdk3.ToolContext {
         error: "workflow execution unavailable: the @enclave-vm sandbox is not installed. Install @enclave-vm/core and @enclave-vm/ast to enable run_workflow."
       };
     }
-    const auditWriter = this.tryGet(import_skills5.SkillAuditWriterToken);
+    const auditWriter = this.tryGet(import_skills6.SkillAuditWriterToken);
     const deps = {
       config: { outbound: config.outbound, unprotectedOps: config.unprotectedOps },
       resolver: { resolve: (ref, opts) => resolver.resolve(ref, opts) },
@@ -1488,7 +1655,7 @@ var RunWorkflowTool = class extends import_sdk3.ToolContext {
   }
 };
 RunWorkflowTool = __decorateClass([
-  (0, import_sdk3.Tool)({
+  (0, import_sdk4.Tool)({
     name: "run_workflow",
     description: runWorkflowDescription,
     inputSchema: runWorkflowInputSchema,
@@ -1542,25 +1709,35 @@ var searchSkillOutputSchema = {
 };
 
 // plugins/plugin-skilled-openapi/src/tools/search-skill.tool.ts
-var import_sdk4 = require("@frontmcp/sdk");
-var SearchSkillTool = class extends import_sdk4.ToolContext {
+var import_skills7 = require("@frontmcp/adapters/skills");
+var import_sdk5 = require("@frontmcp/sdk");
+var SearchSkillTool = class extends import_sdk5.ToolContext {
   async execute(input) {
     await this.get(BundleSyncService).ensureReady();
-    const scope = this.get(import_sdk4.ScopeEntry);
+    const scope = this.get(import_sdk5.ScopeEntry);
     const skillRegistry = scope.skills;
     if (!skillRegistry || !skillRegistry.hasAny()) {
       return { skills: [] };
     }
     const limit = input.limit ?? 20;
     const tags = input.tags;
-    const results = await skillRegistry.search(input.query, {
-      topK: limit,
+    const found = await skillRegistry.search(input.query, {
+      // Over-fetch: skills the caller may not see are removed below.
+      topK: limit * 4,
       ...tags ? { tags } : {},
       // Anti-query demotion (honored when the skill index supports it) — surfaces
       // what the user wants while pushing down what they explicitly do not.
       ...input.notQuery !== void 0 ? { negativeQuery: input.notQuery } : {},
       ...input.notWeight !== void 0 ? { negativeWeight: input.notWeight } : {}
     });
+    const visibility = new SkillVisibility({
+      scope,
+      guard: this.get(AuthorityGuard),
+      bundle: this.get(import_skills7.BundleStore).current(),
+      unprotectedOps: this.get(SkilledOpenApiConfig).unprotectedOps,
+      authInfo: this.authInfo
+    });
+    const results = (await visibility.filterVisible(found, (r) => r.metadata.id ?? r.metadata.name)).slice(0, limit);
     return {
       skills: results.map((r) => ({
         skillId: r.metadata.id ?? r.metadata.name,
@@ -1573,7 +1750,7 @@ var SearchSkillTool = class extends import_sdk4.ToolContext {
   }
 };
 SearchSkillTool = __decorateClass([
-  (0, import_sdk4.Tool)({
+  (0, import_sdk5.Tool)({
     name: "search_skill",
     description: searchSkillDescription,
     inputSchema: searchSkillInputSchema,
@@ -1587,6 +1764,7 @@ SearchSkillTool = __decorateClass([
 
 // plugins/plugin-skilled-openapi/src/skilled-openapi.plugin.ts
 var TELEMETRY_FACTORY_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:observability:telemetry-factory");
+var FilterSkillsHook = (0, import_sdk6.FlowHooksOf)("skills:filter");
 var SKILLED_OPENAPI_RUNTIME_DEPS_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:skilled-openapi:runtime-deps");
 function resolveRuntimeDeps(scope) {
   const providers = scope?.providers;
@@ -1613,7 +1791,7 @@ function resolveBundleTelemetry(scope) {
     startSpan: (name, attributes) => factory.startSpan(name, attributes)
   };
 }
-var SkilledOpenApiPlugin = class extends import_sdk5.DynamicPlugin {
+var SkilledOpenApiPlugin = class extends import_sdk6.DynamicPlugin {
   options;
   cachedLogger;
   constructor(options) {
@@ -1623,7 +1801,7 @@ var SkilledOpenApiPlugin = class extends import_sdk5.DynamicPlugin {
   }
   getLogger() {
     if (!this.cachedLogger) {
-      this.cachedLogger = this.get(import_sdk5.FrontMcpLogger).child("skilled-openapi");
+      this.cachedLogger = this.get(import_sdk6.FrontMcpLogger).child("skilled-openapi");
     }
     return this.cachedLogger;
   }
@@ -1636,16 +1814,62 @@ var SkilledOpenApiPlugin = class extends import_sdk5.DynamicPlugin {
       await this.get(BundleSyncService).ensureReady();
     } catch {
     }
-    const scope = this.get(import_sdk5.ScopeEntry);
-    const catalog = (0, import_sdk5.buildSkillsCatalogSummary)(scope.skills, {
-      mcpResources: scope.metadata?.skillsConfig?.mcpResources
+    const scope = this.get(import_sdk6.ScopeEntry);
+    const visible = await this.skillVisibility(scope, flowCtx.state.authInfo).filterVisibleEntries(
+      scope.skills?.getSkills({ visibility: "mcp" }) ?? []
+    );
+    const catalog = (0, import_sdk6.buildSkillsCatalogSummary)(scope.skills, {
+      mcpResources: scope.metadata?.skillsConfig?.mcpResources,
+      skills: visible
     });
     const description = catalog ? `${searchSkillDescription}
 
 ---
 
 ${catalog}` : searchSkillDescription;
-    target.tool.metadata.description = description;
+    const perRequestTool = Object.create(target.tool, {
+      metadata: { value: { ...target.tool.metadata, description }, enumerable: true }
+    });
+    flowCtx.state.set(
+      "tools",
+      tools.map((item) => item === target ? { ...item, tool: perRequestTool } : item)
+    );
+  }
+  async hideBundleSkillsFromCaller(flowCtx) {
+    const { skills } = flowCtx.state;
+    if (!skills || skills.length === 0) return;
+    const bundle = this.get(import_skills8.BundleStore).current();
+    const policies = bundleSkillPolicies(bundle);
+    if (policies.size === 0) return;
+    const visibility = new SkillVisibility({
+      scope: this.get(import_sdk6.ScopeEntry),
+      guard: this.get(AuthorityGuard),
+      bundle,
+      unprotectedOps: this.options.unprotectedOps,
+      authInfo: this.currentAuthInfo()
+    });
+    const kept = [];
+    for (const skill of skills) {
+      if (await visibility.passesBundleSkillRule(skill.metadata.id ?? skill.name)) kept.push(skill);
+    }
+    if (kept.length !== skills.length) flowCtx.state.set("skills", kept);
+  }
+  skillVisibility(scope, authInfo) {
+    return new SkillVisibility({
+      scope,
+      guard: this.get(AuthorityGuard),
+      bundle: this.get(import_skills8.BundleStore).current(),
+      unprotectedOps: this.options.unprotectedOps,
+      authInfo
+    });
+  }
+  /** The AuthInfo of the request being served; an anonymous caller when there is none. */
+  currentAuthInfo() {
+    try {
+      return this.get(import_sdk6.FrontMcpContextStorage)?.getStore()?.authInfo ?? {};
+    } catch {
+      return {};
+    }
   }
   warnIfInsecureConfig() {
     if (this.options.dev) {
@@ -1667,15 +1891,15 @@ ${catalog}` : searchSkillDescription;
       { name: "skilled-openapi:hidden-ops", provide: HiddenOpRegistry, useValue: new HiddenOpRegistry() },
       {
         name: "skilled-openapi:bundle-store",
-        provide: import_skills6.BundleStore,
+        provide: import_skills8.BundleStore,
         // Resolve TelemetryAccessor from the scope's provider registry so the
         // bundle-pulls counter and `skill.bundle.swap` span actually export.
         // The accessor is structurally compatible with `BundleStoreTelemetry`.
         // ObservabilityPlugin is an optional peer dep — when it isn't installed
         // we resolve `undefined` and the BundleStore falls through its zero-cost
         // no-telemetry path.
-        inject: () => [import_sdk5.ScopeEntry],
-        useFactory: (scope) => new import_skills6.BundleStore({ telemetry: resolveBundleTelemetry(scope) })
+        inject: () => [import_sdk6.ScopeEntry],
+        useFactory: (scope) => new import_skills8.BundleStore({ telemetry: resolveBundleTelemetry(scope) })
       },
       {
         name: "skilled-openapi:credential-resolver",
@@ -1685,13 +1909,23 @@ ${catalog}` : searchSkillDescription;
       {
         name: "skilled-openapi:authority-guard",
         provide: AuthorityGuard,
-        inject: () => [import_sdk5.ScopeEntry],
-        useFactory: (scope) => new AuthorityGuard({ logger: scope.logger.child("skilled-openapi:authority") })
+        inject: () => [import_sdk6.ScopeEntry],
+        useFactory: (scope) => new AuthorityGuard({
+          logger: scope.logger.child("skilled-openapi:authority"),
+          // Bundle rules follow the server's authorities settings (claimsMapping,
+          // claimsResolver, relationshipResolver, evaluators) when it has them. Read per check:
+          // the server may register its engine after this provider is built.
+          serverAuthorities: () => {
+            const engine = scope.authoritiesEngine;
+            const contextBuilder = scope.authoritiesContextBuilder;
+            return engine && contextBuilder ? { engine, contextBuilder } : void 0;
+          }
+        })
       },
       {
         name: "skilled-openapi:bundle-sync",
         provide: BundleSyncService,
-        inject: () => [import_sdk5.ScopeEntry, HiddenOpRegistry, import_skills6.BundleStore],
+        inject: () => [import_sdk6.ScopeEntry, HiddenOpRegistry, import_skills8.BundleStore],
         useFactory: async (scope, hiddenOps, bundleStore) => {
           const logger = scope.logger.child("skilled-openapi:sync");
           const lazySkillRegistry = new Proxy({}, {
@@ -1749,7 +1983,7 @@ ${catalog}` : searchSkillDescription;
           const runtimeDeps = resolveRuntimeDeps(scope);
           let source;
           try {
-            source = (0, import_skills6.createBundleSource)(parsed.source, parsed.bundleCacheDir, logger, runtimeDeps);
+            source = (0, import_skills8.createBundleSource)(parsed.source, parsed.bundleCacheDir, logger, runtimeDeps);
           } catch (e) {
             logger.error(`failed to construct bundle source: ${e.message}`);
             return sync;
@@ -1774,14 +2008,20 @@ ${catalog}` : searchSkillDescription;
   }
 };
 __decorateClass([
-  import_sdk5.ListToolsHook.Did("findTools", { priority: 50 })
+  import_sdk6.ListToolsHook.Did("findTools", { priority: 50 })
 ], SkilledOpenApiPlugin.prototype, "injectSkillCatalogIntoSearchTool", 1);
+__decorateClass([
+  FilterSkillsHook.Did("filterSkills", { priority: 50 })
+], SkilledOpenApiPlugin.prototype, "hideBundleSkillsFromCaller", 1);
 SkilledOpenApiPlugin = __decorateClass([
-  (0, import_sdk5.Plugin)({
+  (0, import_sdk6.Plugin)({
     name: "skilled-openapi",
     description: "Serve a customer's OpenAPI spec as signed skill bundles with hidden per-operation tools mediated by 3 meta-tools.",
     providers: [],
-    tools: [SearchSkillTool, LoadSkillTool, RunWorkflowTool]
+    tools: [SearchSkillTool, LoadSkillTool, RunWorkflowTool],
+    // The bundle's skills are registered after startup: serve the skills capability and methods from
+    // startup, answering with the skills loaded so far.
+    dynamicSkills: true
   })
 ], SkilledOpenApiPlugin);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-skilled-openapi",
-  "version": "1.8.2",
+  "version": "1.8.4",
   "description": "FrontMCP plugin: serve a customer's OpenAPI spec as skill bundles (signed, OpenAPI-Overlay-based) with hidden per-operation tools mediated by three meta-tools (search_skill / load_skill / run_workflow — the last runs an enclave-sandboxed AgentScript that orchestrates the loaded skills' operations).",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -48,15 +48,15 @@
     }
   },
   "dependencies": {
-    "@frontmcp/adapters": "1.8.2",
-    "@frontmcp/auth": "1.8.2",
-    "@frontmcp/sdk": "1.8.2",
-    "@frontmcp/utils": "1.8.2"
+    "@frontmcp/adapters": "1.8.4",
+    "@frontmcp/auth": "1.8.4",
+    "@frontmcp/sdk": "1.8.4",
+    "@frontmcp/utils": "1.8.4"
   },
   "peerDependencies": {
     "@enclave-vm/ast": "*",
     "@enclave-vm/core": "*",
-    "@frontmcp/lazy-zod": "1.8.2"
+    "@frontmcp/lazy-zod": "1.8.4"
   },
   "peerDependenciesMeta": {
     "@enclave-vm/ast": {

package/security/authority-guard.d.ts

@@ -1,8 +1,23 @@
 import type { AuthoritiesPolicy } from '@frontmcp/adapters/skills';
-import { AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry, type AuthoritiesResult } from '@frontmcp/auth';
+import { AuthoritiesContextBuilder, AuthoritiesEngine, AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry, type AuthoritiesResult } from '@frontmcp/auth';
 import type { FrontMcpLogger } from '@frontmcp/sdk';
 /** How an op with NO authorities policy at all is treated by {@link AuthorityGuard}. */
 export type UnprotectedOpsPolicy = 'allow' | 'deny';
+/** The server's authorities engine and context builder, when the server configures authorities. */
+export interface ServerAuthorities {
+    engine: AuthoritiesEngine;
+    contextBuilder: AuthoritiesContextBuilder;
+}
+/** What {@link AuthorityGuard.canDiscover} needs: the rules of an action, without its input. */
+export type DiscoveryCheckArgs = Omit<AuthorityCheckArgs, 'input' | 'env' | 'policy'> & {
+    policy?: AuthoritiesPolicy;
+};
+/**
+ * Whether a policy reads the action's input (or runs code the guard can't see
+ * into): `input.*` paths or keys, `fromInput` references, `custom` evaluators and
+ * `guards`. Such a policy can't be judged before the action is called.
+ */
+export declare function policyDependsOnInput(value: unknown): boolean;
 export interface AuthorityCheckArgs {
     /** Op-level required-authorities policy from the bundle (`OperationDescriptor.requiredAuthorities`). */
     policy: AuthoritiesPolicy | undefined;
@@ -54,11 +69,29 @@ export declare class AuthorityGuard {
     private readonly engine;
     private readonly contextBuilder;
     private readonly logger;
+    private readonly serverAuthorities;
     constructor(opts?: {
         profiles?: AuthoritiesProfileRegistry;
         evaluators?: AuthoritiesEvaluatorRegistry;
         logger?: FrontMcpLogger;
+        /**
+         * The server's authorities, read on every check (the server may register
+         * them after this guard is built). When it returns an engine and context
+         * builder, they replace the guard's own defaults.
+         */
+        serverAuthorities?: () => ServerAuthorities | undefined;
     });
+    /** The server's engine and context builder when it configures authorities, else the guard's own. */
+    private authorities;
+    /**
+     * Whether the caller may be shown a skill or action (in `search_skill`,
+     * `load_skill`, the catalog and the SDK skill surfaces), judged without the
+     * action's input. A rule that depends on the input can't be judged yet and
+     * doesn't hide anything; the call is still checked by {@link check}. Every other
+     * rule must grant, and a policy-less action under `unprotectedOps: 'deny'` must
+     * be public, exactly as at call time.
+     */
+    canDiscover(args: DiscoveryCheckArgs): Promise<boolean>;
     check(args: AuthorityCheckArgs): Promise<AuthoritiesResult>;
 }
 //# sourceMappingURL=authority-guard.d.ts.map

package/security/authority-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-guard.d.ts","sourceRoot":"","sources":["../../src/security/authority-guard.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAGL,4BAA4B,EAC5B,0BAA0B,EAG1B,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,wGAAwG;IACxG,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACvF,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAGlD,IAAI,GAAE;QACJ,QAAQ,CAAC,EAAE,0BAA0B,CAAC;QACtC,UAAU,CAAC,EAAE,4BAA4B,CAAC;QAC1C,MAAM,CAAC,EAAE,cAAc,CAAC;KACpB;IASF,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAsDlE"}
+{"version":3,"file":"authority-guard.d.ts","sourceRoot":"","sources":["../../src/security/authority-guard.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAG1B,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEpD,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,cAAc,EAAE,yBAAyB,CAAC;CAC3C;AAED,gGAAgG;AAChG,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC,GAAG;IACtF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU5D;AAwBD,MAAM,WAAW,kBAAkB;IACjC,wGAAwG;IACxG,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACvF,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoD;gBAGpF,IAAI,GAAE;QACJ,QAAQ,CAAC,EAAE,0BAA0B,CAAC;QACtC,UAAU,CAAC,EAAE,4BAA4B,CAAC;QAC1C,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB;;;;WAIG;QACH,iBAAiB,CAAC,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;KACpD;IAUR,oGAAoG;IACpG,OAAO,CAAC,WAAW;IAInB;;;;;;;OAOG;IACG,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAWvD,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAuDlE"}

package/security/skill-visibility.d.ts

@@ -0,0 +1,46 @@
+import type { AuthoritiesPolicy, ResolvedBundle } from '@frontmcp/adapters/skills';
+import { type ScopeEntry, type SkillAction, type SkillEntry } from '@frontmcp/sdk';
+import type { HiddenOpRegistry } from '../registry/hidden-op.registry';
+import type { AuthorityGuard, UnprotectedOpsPolicy } from './authority-guard';
+export interface SkillVisibilityDeps {
+    scope: ScopeEntry;
+    guard: AuthorityGuard;
+    /** The active bundle, whose skill-level `requiredAuthorities` gate its skills. */
+    bundle: ResolvedBundle | undefined;
+    unprotectedOps: UnprotectedOpsPolicy;
+    /** The caller's AuthInfo. */
+    authInfo: unknown;
+}
+/** The skill-level rule of each skill in `bundle` that has one. */
+export declare function bundleSkillPolicies(bundle: ResolvedBundle | undefined): Map<string, AuthoritiesPolicy>;
+export declare class SkillVisibility {
+    private readonly deps;
+    private readonly policies;
+    private readonly authInfo;
+    constructor(deps: SkillVisibilityDeps);
+    /** Whether the caller satisfies the bundle skill's own `requiredAuthorities` (true for other skills). */
+    passesBundleSkillRule(skillId: string): Promise<boolean>;
+    /**
+     * Keep the items whose skill the caller may see: the bundle skill's rule, the
+     * `skills:filter` flow and the server's `@Skill({ authorities })` rule. An item
+     * whose id names no registered skill (an external skill) is judged by the bundle
+     * rule alone, as the SDK's own surfaces keep such results.
+     */
+    filterVisible<T>(items: readonly T[], idOf: (item: T) => string): Promise<T[]>;
+    /** The registered skills the caller may see, in their order (see {@link filterVisible}). */
+    filterVisibleEntries<T extends SkillEntry>(entries: readonly T[]): Promise<T[]>;
+    /** Whether the caller may see the skill named by `skillId` (see {@link filterVisible}). */
+    isVisible(skillId: string): Promise<boolean>;
+    /**
+     * The actions of a bundle skill the caller may be shown: an action whose rules
+     * refuse the caller whatever the input (or that `unprotectedOps: 'deny'` blocks)
+     * is left out. Rules that depend on the input keep the action listed; the call is
+     * checked again when it runs.
+     */
+    visibleActions(skillId: string, actions: readonly SkillAction[], hiddenOps: HiddenOpRegistry): Promise<SkillAction[]>;
+    /** The server's `@Skill({ authorities })` rule, evaluated as the SDK's skill surfaces do. */
+    private passesSkillAuthorities;
+    /** The registered skill an id names, looked up the way the SDK's skill surfaces do. */
+    private resolveEntry;
+}
+//# sourceMappingURL=skill-visibility.d.ts.map

package/security/skill-visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-visibility.d.ts","sourceRoot":"","sources":["../../src/security/skill-visibility.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEnF,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEzG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAI9E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,kFAAkF;IAClF,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,oBAAoB,CAAC;IACrC,6BAA6B;IAC7B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAQtG;AAED,qBAAa,eAAe;IAId,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;gBAEb,IAAI,EAAE,mBAAmB;IAKtD,yGAAyG;IACnG,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM9D;;;;;OAKG;IACG,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAepF,4FAA4F;IACtF,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAYrF,2FAA2F;IACrF,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlD;;;;;OAKG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,SAAS,EAAE,gBAAgB;IAiBlG,6FAA6F;YAC/E,sBAAsB;IAepC,uFAAuF;IACvF,OAAO,CAAC,YAAY;CASrB"}

package/skilled-openapi.plugin.d.ts

@@ -57,6 +57,16 @@ export default class SkilledOpenApiPlugin extends DynamicPlugin<SkilledOpenApiPl
      * from the static base each time, never appended onto a prior catalog.
      */
     injectSkillCatalogIntoSearchTool(flowCtx: FlowCtxOf<'tools:list-tools'>): Promise<void>;
+    /**
+     * Hide a bundle skill from a caller who doesn't satisfy its `requiredAuthorities`
+     * on every SDK skill surface (skills/list, skills/search, skills/load, the
+     * `skill://` resources, the HTTP /skills API): a skill this flow drops is absent
+     * there and not found when named. The plugin's own meta-tools apply the same rule.
+     */
+    hideBundleSkillsFromCaller(flowCtx: FlowCtxOf<'skills:filter'>): Promise<void>;
+    private skillVisibility;
+    /** The AuthInfo of the request being served; an anonymous caller when there is none. */
+    private currentAuthInfo;
     private warnIfInsecureConfig;
     static dynamicProviders(options: SkilledOpenApiPluginOptionsInput): ProviderType[];
 }

package/skilled-openapi.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skilled-openapi.plugin.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,gBAAgB,EAIrB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,aAAa,EAKb,KAAK,SAAS,EAEd,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAMvB,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACtC,MAAM,yBAAyB,CAAC;AAmBjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,eAAsD,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE;;;;OAIG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC1C;AAqDD;;;;;;;;;;;;GAYG;AAQH,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,aAAa,CAC7D,2BAA2B,EAC3B,gCAAgC,CACjC;IACC,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,OAAO,EAAE,gCAAgC;IAMrD,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;OAUG;IAEG,gCAAgC,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB7F,OAAO,CAAC,oBAAoB;WAaZ,gBAAgB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY,EAAE;CA0J5F"}
+{"version":3,"file":"skilled-openapi.plugin.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,gBAAgB,EAIrB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,aAAa,EAOb,KAAK,SAAS,EAEd,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACtC,MAAM,yBAAyB,CAAC;AAsBjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,eAAsD,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE;;;;OAIG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC1C;AAqDD;;;;;;;;;;;;GAYG;AAWH,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,aAAa,CAC7D,2BAA2B,EAC3B,gCAAgC,CACjC;IACC,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,OAAO,EAAE,gCAAgC;IAMrD,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;OAUG;IAEG,gCAAgC,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC7F;;;;;OAKG;IAEG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpF,OAAO,CAAC,eAAe;IAUvB,wFAAwF;IACxF,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,oBAAoB;WAaZ,gBAAgB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY,EAAE;CAoK5F"}

package/tools/load-skill.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load-skill.tool.d.ts","sourceRoot":"","sources":["../../src/tools/load-skill.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsD,WAAW,EAAE,MAAM,eAAe,CAAC;AAGhG,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAY7B,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IAC9C,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAgC/D"}
+{"version":3,"file":"load-skill.tool.d.ts","sourceRoot":"","sources":["../../src/tools/load-skill.tool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsD,WAAW,EAAE,MAAM,eAAe,CAAC;AAOhG,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAY7B,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IAC9C,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAkD/D"}

package/tools/search-skill.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search-skill.tool.d.ts","sourceRoot":"","sources":["../../src/tools/search-skill.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,WAAW,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAY/B,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IAChD,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAkCnE"}
+{"version":3,"file":"search-skill.tool.d.ts","sourceRoot":"","sources":["../../src/tools/search-skill.tool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoB,WAAW,EAAE,MAAM,eAAe,CAAC;AAM9D,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAY/B,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IAChD,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA8CnE"}